Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In a single sign-on (SSO) system, what does the service provider (SP) typically receive after the user authenticates at the identity provider (IdP)?

   • AAn assertion or token that proves the user's identity
   • BThe user's biometric data
   • CA direct connection to the IdP's user database
   • DThe user's password hash
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In a typical cloud SSO flow, what is the correct order of events after a user attempts to access a cloud application?

   • AThe SP sends the user to the IdP, the user authenticates, the IdP issues a token, and the SP validates the token and grants access.
   • BThe IdP sends the user to the SP, the SP authenticates the user, and then the IdP issues a token.
   • CUser authenticates at the SP, then the SP sends the user to the IdP, which issues a token to the SP.
   • DThe user authenticates at the IdP, the IdP stores the user's password, and then the user logs into the SP directly.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is a key security consideration when validating tokens in a federated environment?

   • ATokens should be accepted without validation to ensure seamless user experience.
   • BTokens should be validated for signature, expiration, and audience to prevent unauthorized access.
   • CTokens should be stored in the user's browser to allow offline access.
   • DTokens should be encrypted with the user's password to ensure confidentiality.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is implementing SSO using OIDC. The company's security policy requires that access tokens be validated on every API call. The API gateway currently validates the token's signature and expiry but does not check with the IdP. What is the best way to meet the policy requirement?

   • AUse a local cache of revoked tokens and check against it.
   • BRely on the token's signature and expiry only.
   • CConfigure the API gateway to call the IdP's introspection endpoint on each request.
   • DUse shorter token lifetimes to reduce the risk of using revoked tokens.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A user is accessing a cloud application through SSO. The application receives a SAML assertion and creates a local session. Later, the user's account is disabled in the identity provider. What happens to the user's existing session in the application?

   • AThe session remains active until it expires or the application checks the IdP again.
   • BThe application will reject the next request because it validates the assertion on every request.
   • CThe session is immediately terminated because the IdP sends a logout request to the application.
   • DThe session is converted to a guest session with limited privileges.
   Reveal Solution Discussion Select an answer first